Commit 26abc916 authored by Mike Christie's avatar Mike Christie Committed by Matthew Wilcox

iscsi target: fix session creation failure handling

The problem is that iscsi_login_zero_tsih_s1 sets conn->sess early in
iscsi_login_set_conn_values. If the function fails later like when we
alloc the idr it does kfree(sess) and leaves the conn->sess pointer set.
iscsi_login_zero_tsih_s1 then returns -Exyz and we then call
iscsi_target_login_sess_out and access the freed memory.

This patch has iscsi_login_zero_tsih_s1 either completely setup the
session or completely tear it down, so later in
iscsi_target_login_sess_out we can just check for it being set to the
connection.

Cc: stable@vger.kernel.org
Fixes: 0957627a ("iscsi-target: Fix sess allocation leak in...")
Signed-off-by: default avatarMike Christie <mchristi@redhat.com>
Acked-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarMatthew Wilcox <willy@infradead.org>
parent 4eb085e4
...@@ -348,8 +348,7 @@ static int iscsi_login_zero_tsih_s1( ...@@ -348,8 +348,7 @@ static int iscsi_login_zero_tsih_s1(
pr_err("idr_alloc() for sess_idr failed\n"); pr_err("idr_alloc() for sess_idr failed\n");
iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
ISCSI_LOGIN_STATUS_NO_RESOURCES); ISCSI_LOGIN_STATUS_NO_RESOURCES);
kfree(sess); goto free_sess;
return -ENOMEM;
} }
sess->creation_time = get_jiffies_64(); sess->creation_time = get_jiffies_64();
...@@ -365,20 +364,28 @@ static int iscsi_login_zero_tsih_s1( ...@@ -365,20 +364,28 @@ static int iscsi_login_zero_tsih_s1(
ISCSI_LOGIN_STATUS_NO_RESOURCES); ISCSI_LOGIN_STATUS_NO_RESOURCES);
pr_err("Unable to allocate memory for" pr_err("Unable to allocate memory for"
" struct iscsi_sess_ops.\n"); " struct iscsi_sess_ops.\n");
kfree(sess); goto remove_idr;
return -ENOMEM;
} }
sess->se_sess = transport_init_session(TARGET_PROT_NORMAL); sess->se_sess = transport_init_session(TARGET_PROT_NORMAL);
if (IS_ERR(sess->se_sess)) { if (IS_ERR(sess->se_sess)) {
iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
ISCSI_LOGIN_STATUS_NO_RESOURCES); ISCSI_LOGIN_STATUS_NO_RESOURCES);
kfree(sess->sess_ops); goto free_ops;
kfree(sess);
return -ENOMEM;
} }
return 0; return 0;
free_ops:
kfree(sess->sess_ops);
remove_idr:
spin_lock_bh(&sess_idr_lock);
idr_remove(&sess_idr, sess->session_index);
spin_unlock_bh(&sess_idr_lock);
free_sess:
kfree(sess);
conn->sess = NULL;
return -ENOMEM;
} }
static int iscsi_login_zero_tsih_s2( static int iscsi_login_zero_tsih_s2(
...@@ -1161,13 +1168,13 @@ void iscsi_target_login_sess_out(struct iscsi_conn *conn, ...@@ -1161,13 +1168,13 @@ void iscsi_target_login_sess_out(struct iscsi_conn *conn,
ISCSI_LOGIN_STATUS_INIT_ERR); ISCSI_LOGIN_STATUS_INIT_ERR);
if (!zero_tsih || !conn->sess) if (!zero_tsih || !conn->sess)
goto old_sess_out; goto old_sess_out;
if (conn->sess->se_sess)
transport_free_session(conn->sess->se_sess); transport_free_session(conn->sess->se_sess);
if (conn->sess->session_index != 0) {
spin_lock_bh(&sess_idr_lock); spin_lock_bh(&sess_idr_lock);
idr_remove(&sess_idr, conn->sess->session_index); idr_remove(&sess_idr, conn->sess->session_index);
spin_unlock_bh(&sess_idr_lock); spin_unlock_bh(&sess_idr_lock);
}
kfree(conn->sess->sess_ops); kfree(conn->sess->sess_ops);
kfree(conn->sess); kfree(conn->sess);
conn->sess = NULL; conn->sess = NULL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment